Architecture, reliability & security assurance — found from sitemap — Twingate

Cited by

Facts read from this source

• No inbound ports Report an error

  “Twingate offers better security than a traditional VPN because, among other aspects, it does not require any open inbound ports to operate.”

• Components Report an error

  “Twingate relies on two components which are hosted by the customer (the Client, deployed on an end user’s device, and the Connector, deployed behind the firewall within the customer’s infrastructure), and two components hosted by Twingate (the Relays and Controller).”

• Encryption goals Report an error

  “Confidentiality: We need to ensure that traffic between user components (Clients and Connectors) are encrypted and cannot be decrypted by any third party (including Twingate)”

• Tls to controller Report an error

  “It uses HTTPS which means it uses TLS (Transport Layer Security, https is http secured by TLS).”

• Connector self signed cert Report an error

  “At startup time, the Connector generates a public and private key pair used by the Connector to generate a self-signed certificate.”

• Connector heartbeat sha256 Report an error

  “When active, the Connector sends a regular heartbeat to the Controller containing a digest/fingerprint (SHA-256) of its self signed certificate, which the Controller then stores.”

• Connection token jwt Report an error

  “The Controller issues a Connection Token (which is a JWT token signed by the Controller) and sends it to the Client (the CT contains the SHA-256 digest of the self-signed certificate from the Connector via its heartbeat)”

• Session key client connector Report an error

  “Upon verification, trust between Client and Connector is established and the Client shares a session key with the Connector using the Connector’s public key”

• Relay cannot decrypt Report an error

  “nothing between a Client and Connector (including any Relays) can decrypt packets because they are encrypted by a session key generated by the Client and shared with the Connector using a public key from its self-signed certificate.”

• Ca lets encrypt Report an error

  “When an entity like Twingate wants to obtain a signed certificate for its domain (twingate.com), it contacts a CA (Let’s Encrypt, in our case)”

• P2p or relay same encryption Report an error

  “This process is true whether communication between a Client and Connector is peer-to-peer or via Relays.”

Scores citing this record

• The DevOps Engineer Access model & connectivity
• The DevOps Engineer Architecture, reliability & security assurance
• The IT Lead Access model & connectivity
• The IT Lead Architecture, reliability & security assurance
• The IT Lead European sovereignty
• The MSP Technician Access model & connectivity
• The MSP Technician Architecture, reliability & security assurance
• The Operations Manager Access model & connectivity
• The Operations Manager Architecture, reliability & security assurance
• The Information Security Officer Access model & connectivity
• The Information Security Officer Architecture, reliability & security assurance
• The Skeptic Architecture, reliability & security assurance